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ABSTRACT.  This  report  describes  the  basic  considerations  of  an  effec¬ 
tive  and  comparatively  low-coat  reliability  program  for  an  exemplary  air¬ 
borne  missile.  It  covers  cases  where  expediency  precludes  full  reliability 
considerations  prior  to  production  go-ahead  and  where  the  manufacturer  has 
accepted  a  contractual  requirement  to  demonstrate  reliability  at  the  systems 
level.  It  apportions  reliability  requirements,  delineates  important  proce¬ 
dures  that  will  provide  worthwhile  reliability  assurance  at  reasonable  cost, 
and  fits  the  program  into  the  quality  assurance  provisions  of  o  typical 
manufacturer  oriented  to  military  contracts.  The  program  is  intended  for 
missiles  that  are  produced  in  small  quantities. 
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FOREWORD 

This  report  expands  the  hi^lights  of  a  reliability  indoctrina¬ 
tion  lecture  delivered  to  members  of  the  Philco  Communications 
and  Electronics  Division  technical  staff  in  Philadelphia,  Pa.,  on 
30  June  1964.  It  is  released  for  use  with  other  reliability  reference 
data.  Expansion  of  the  included  procedures  and  concepts  can 
provide  higher  reliability  than  is  currently  being  achieved  by  some 
programs  in  which  costs  are  greater  by  an  order  of  magnitude. 
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INTROOUCTiOH 

The  implementation  of  an  effective  reliability  program  is  as  much  an  art  as  it  is  a  science. 

The  existence  of  a  formal  program  does  not  always  provide  assurance  that  the  reliability  of  a 
system  or  unit  will  be  satisfactory.  There  have  been  instances  where  implemented  disciplines 
have  resulted  in  serious  production  slowdowns,  and  still  other  instances  where  disruption  of 
product  flow  caused  an  actual  net  decrease  in  reliability.  A  worthwhile  ex  post  facto  reliability 
program  must  provide  short  cuts  to  worthwhile  reliability  and  also  should  include  applicable  value 
engineering  of  a  self-disciplinary  nature.  Such  a  program  should  be  used  only  when  it  is  too  late 
or  too  expensive  to  include  full  reliability  considerations  at  or  near  the  conceptual  stage. 

There  is  a  wide  variation  in  industry  as  to  the  degree  of  reliability  implementation  used  on 
the  various  programs  now  in  existence.  As  technical  requirements  become  more  and  more  com¬ 
plex,  vendors  with  established  reputations  can  suddenly  drop  far  behind  in  the  implementation  of 
the  minimal  considerations  necessary  to  maintain  a  required  reliability.  Some  vendors  are  refusing 
to  keep  pace  not  only  with  the  complexities  of  modem  reliability  but  also  with  today’s  stringent 
quality  control  requirements,  and  in  certain  cases  are  forcing  procurement  agencies  to  accept 
components  of  poorer  quality  than  desired.  Still  other  vendors  believe  that  they  are  producing 
reliable  components,  but  lack  the  over-all  technical  capability  to  evaluate  their  products  objec¬ 
tively.  This  paper  calls  attention  to  new,  successful  procedures  such  as  Machining  Reliability 
Control  (MRC)  currently  in  use  at  Parker  Aircraft  Co. 

An  effective  ex  post  facto  reliability  program  roust  consider  practical  requirements,  vendor 
capabilities,  costs,  schedules,  and  reliability  value.  (The  term  “reliability  value”  indicates  value 
engineering  considerations  with  respect  to  reliability.)  Should  the  design  assurance  program 
prove  to  be  inadequate,  additional  design  assurance  must  be  conducted  in  areas  that  prove  to  be 
troublesome.  This  report  presents  an  exemplary  program  as  a  basic  reliability  philosophy  to  be 
considered,  expanded,  and  improved. 

BASIC  RELIABILITY  CONSIDERATIOKS 

DEFINITION  OF  “RELIABILITY” 

The  term  ’’reliability,**  when  used  herein,  is  based  upon  standard  present-day  techniques  for 
computing  the  ’’probability  of  survival.”  It  is  mathematically  expressed  in  the  following  simplified 
equation  b>'  the  term  ”R**: 

R  =  e-^‘  (1) 


where  e  =  the  Naperian  logarithm  base 

A  =  failure  rate  in  failures  per  hour 
(  =  operating  time  in  hours 

Reliability,  then,  is  the  probability  that  a  device  or  system,  operating  within  discrete  performance 
limits  in  a  specified  environment,  will  survive  for  a  given  time.  The  actual  mission  reliability  of 
a  missile  is  the  number  of  successful  missions  divided  by  the  total  number  of  missions  launched. 
Failure  rates  can  vary  with  time,  and  readers  are  referred  to  papers  on  the  Weibull  Distribution 
for  a  deeper  analysis. 
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RELIABILfTY  APPORTIONMENT 

The  reliability  diagram  of  an  exemplar)’  missile  is  depicted  in  Fig.  1.  Calculations  for  ex* 
amples  used  in  this  publication  will  be  based  upon  this  standard  configuration,  and  reliability 
considerations  cein  be  transferred  to  a  specific  missile  bv  the  application  of  simple  adaptive 
techniques. 


FIG,  1,  Rcliabihty  <7:?gram. 
Standard  Airborne  Missile. 


For  a  reliability  apportionment,  experience  and  judgment  (as  shown  in  MIL'STD*105)  are  used 
to  obtain  an  estimate  of  the  reliability  requirements  for  various  sections  or  subassemblies  to 
provide  the  over*aII  net  reliability  on  a  feasible  basis.  Although  reliability  predictions  are  vul¬ 
nerable  to  challenge,  use  of  prediction  data  for  comparisons  of  performance  or  achievement  is 
invaluable. 

For  the  block  diagram  of  Fig.  1,  the  over-all  mission  reliability  (the  intercept  reliability  or 
probability  of  successful  intercept)  is  determined  by  the  following  formula: 

Ri  =  rr’  rua  •  rc  >  r^a  •  (2) 

where  1^  =  intercept  reliability  (reliability  during  intercept  phase  of  mission) 

^  =  reliability  of  the  rocket  motor 
=  reliability  of  the  wing  assembly 
tc  =  reliability  of  the  control  assembly 
rvj=  reliability  of  safety  and  anning  devices 
reliability  of  the  warhead 

Each  subassembly  of  the  typical  missile  will  have  certain  basic  reliability  capabilities. 
Thorough  analysis  of  the  parts  in,  and  stresses  of,  each  subassembly  will  yield  a  basic  component 
reliability.  The  product  of  these  component  reliabilities  will  indicate  a  basic  reliability  capa¬ 
bility  for  the  entire  assembly-  Comparison  of  the  basic  reliability  capability  with  the  desired 
reliability  will  show  that  the  subassembly  must  be  designed  and  built  to  subnormal,  normal,  or 
rigid  requirements.  The  originally  indicated  reliability  can  then  be  modified  to  reflect  the  ex¬ 
pected  reliability  as  a  result  of  the  new  standard  for  design  and  construction.  This  process  is 
known  as  reliability  apportionment.  For  the  typical  airborne  missile  under  consideration,  reli¬ 
ability  can  be  apportioned  as  follows: 
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Reliahiiity  Probability  of  failure. 


Subassembly 

per  flight 

per  flight 

Rocket  motor 

0-95 

0.05 

Wing  assembly 

0.97 

0.03 

Control  assembly 

0.90 

0.10 

Safety  and  arming 

0.98 

0.02 

Wadiead 

0.99 

0.01 

Product 

0.80  Sum 

0.21 

It  should  be  noted  that  1.00  -  0.80  is  not  equal  to  0.21.  Two  significant  figures  are  used  in 
lieu  of  such  terms  as  0.7998736  to  assure  concentration  on  the  philosophy. 


APPORTIONED  LABORATORY  FAILURE  RATES 

M1L-STD-756A  calls  out  an  operational  factor  of  80  for  missiles.  1  This  means  that  a  typical 
missile  in  flight  will  fail  80  times  as  frequently  as  it  would  under  laboratory  test  conditions.  For 
tbe  rocket  motor,  then,  the  probability  of  failure  during  laborator>'  test  conditions  must  be  1/80 
times  the  probability  of  failure,  Q.  per  flight,  or  0.000625,  during  a  time  equal  to  the  time  of  flight. 
Failure  rates  usually  are  expressed  in  multiples  of  an  hour.  A  l>minute  fli^t  is  typical  of  an 
airborne  missile,  and  the  failure  rate  of  the  rocket  motor  per  laborator}'  hour  will  be  60  times  that 
for  a  laboratory  minute,  or  0.0375.  Similar  calculations  for  the  control  assembly  yield  an  allow* 
able  failure  rate  of  0.075  per  laboratory  hour. 

A  typical  control  assembly  will  include  an  input  section,  an  electronics  section,  a  servo 
section,  mid  an  output  section.  The  laboratory  failure  rate  for  the  control  assembly  can  be 
apportioned  among  its  various  sections  as  listed  below: 


Section 

R/hour  (lab  mte)2  Q/hour  flab  ratefi 

Input 

0.970 

0.030 

Electronics 

0.970 

0.030 

Servo 

0.990 

0.010 

Output 

0.995 

0.005 

Product 

0.925 

Sum  0.075 

The  laboratory  failure  rate  can  be  alternately  expressed  as  follows: 

Section 

Q/hour  Q 

%/l0^  hours 

0*,  e*  n(fi  ftours*  mtbf,  kowsb 

Input 

0.030 

3,000 

30,000 

33 

Electronics 

0.030 

3,000 

30,000 

33 

Servo 

0.010 

1,000 

10,000 

100 

Output 

0.005 

500 

5,000 

200 

I  Hie  nwltiplief,  80,  may  not  be  in  accord  with  other  indices  familiar  to  the  reader.  However,  the 
use  of  MILrSH)>756A,  as  a  reliability  reference,  is  mandatory  for  BuWeps  considerations. 

ZR/honr  is  the  probability  of  survival  for  1  hour. 

^Q/hoor  is  the  probability  of  failure  in  1  hour. 

4^/10^  hours  is  failures  per  million  hours . 

5^^BF  is  the  mean  time  between  failures  (with  replacement  upon  failure). 
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SUBASSEMBLY  LABORATORY  FAILURE  RATE  APPORTiOHMENT 


The  term  “%/103  hours'*  is  the  usual  method  of  presentation  of  failure  rates  at  or  near  the 
component  level  (MIL-217).  Further  apportionment  can  be  made  for  each  section.  For  instance, 
the  laboratory  failure  rate  for  subassemblies  of  an  exemplary  electronics  section  can  be  appor¬ 
tioned  as  follows: 


Input  section  subassembly 

Sensing 

Amplifier 

Servo  amplifier 

Servo  drive 

Control 

Cables  and  miscellaneous 
Total 


Q',  %/10^  hours  (lab  rate) 
300 
■100 
500 
500 
500 
800 

3.00057 '103  hours 


The  sensing  (or  equivalent)  subassembly  also  can  be  apportioned.  A  100-part  sensing  unit  would 
be  allowed  an  average  basic  failure  rate  of  357  per  1,000  hours  per  part.  The  allowable  basic 
failure  rate  includes  mission  and  other  operating  and  correction  factors,  which  will  be  discussed 
later. 


Typical  failure  rates  for  a  few  electromechanical  components  are  listed  below  (failure  rates 
are  extracted  from  MIL-217): 


Item 

Failure  rate/lO^  hours 

Subminiature  tube 

1.33 

Diode 

0.04 

Transistor 

0.22 

Microwave  diode 

7.00 

Resistor 

0.06 

Capacitor 

0.08 

20-pin  connector 

0.32 

Relay 

0.2 

Small  motor 

0.8 

Solder  joints  (10  considered 
as  one  part) 

0.03 

Total 

10.08 

Average 

1.008 

The  above  rates  will  vary  with  mission,  stress,  application,  and  manufacturer  (MIL-217). 
This  example  indicates  that  the  design  goal  intercept  reliability  is  ach'evable  for  the  evaluated 
design  concept,  in  the  case  of  a  100-component  design  with  10  each  of  the  listed  components, 
wherein  10  each  of  a  10-component  group  totals  100  components.  The  allowable  average  for  a 
100-component  design  is  357  per  1,000  hours.  The  average  of  the  typical  components  above 
is  1.00857  per  1,000  hoars.  The  design  is  feasible,  since  1.008  is  less  than  3. 


RELIABILITY  IMPLEMENTATION 

ACHIEVEMENT  OF  RELIABILITY 

Reliability  can  be  achieved  only  by  specific  attention  to  important  details  from  the  concep¬ 
tion  of  to  the  use  of  the  product.  Perfection  is  not  required,  yet  a  good  reliability  program  may 
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be  described  as  one  of  “specific  tolerance  to  imperfection •“  There  are  hundreds  of  articles  and 
manuals  describing  methods  of  achieving  reliability.  Most  of  the  accepted  methods  are  either 
in  use  or  are  extremely  expensive;  most  manufacturers  use  reliability  programs  they  consider  to 
be  the  most  practical  for  the  existing  situation.  It  is  important  that  one  man,  or  one  group,  in  a 
company  serve  as  the  assembler,  interpreter,  and  referee  of  reliability  data. 

Several  important  areas  of  reliability  control  can  be  used  by  a  conscientious  manufacturer  to 
exert  sufficient  leverage  to  assure  achieving  a  reasonably  high  reliability  without  the  usual 
staggering  costs  of  such  an  accomplishment.  These  areas  are  as  follows: 

1.  Individual  responsibility 

2.  Receiving  inspection 

3.  Special  attention  to  qualification  and  performance  at  the  module  level 

4.  Failure  reporting  and  analysis 

The.  term  “individual  responsibility”  is  receiving  considerable  attention  at  Parker  Aircraft 
Co.,  at  the  Martin  Co.  and  its  subcontractors,  and  elsewhere.  This  term  includes  and  depends 
upon  pride  of  accomplishment,  team  spirit,  reasonably  conscientious  workmanship,  and  assump¬ 
tion  of  responsibility  at  the  lowest  practical  levels.  It  is  difficult  to  express  individual  respon¬ 
sibility  in  mathematical  terms,  but  this  difficulty  is  no  excuse  for  leaving  out  one  of  the  prime 
ingredients  used  by  successful  manufacturers  of  reliable  equipment. 

The  term  “receiving  inspection”  includes  sampling  of  all  incoming  parts  and  in-house- 
produced  parts,  as  well  as  vendor  control  and  compilation  of  important  quality  statistics.  Inso¬ 
far  as  is  practicable,  parts  of  known  or  guaranteed  reliability  should  be  purchased.  Some  man¬ 
ufacturers  are  producing  parts  with  known  or  certified  reliabilities.  For  instance.  Motorola 
manufactures  semiconductors  to  various  standards  of  reliability.  For  a  small  premium  in  cost, 
Motorola  Inc.  will  supply  certain  basic  types  of  MIL-Spec  semiconductors  subjected  to  additional 
processes  such  as  bum-in,  screening,  and  special  inspections,  and  will  furnish  generic  or  lot  data. 
The  savings  in  subsequent  testing,  troubleshooting,  and  reworking  seem  to  be  well  worth  the 
additional  cost  premium.  The  purchase  of  parts  from  alert  manufacturers  will  help  to  achieve 
high  reliability  at  low  cost. 

It  is  to  be  noted  that  a  failure  rate  of  3%  per  1,000  hours  is  allowable  for  a  typical  part  in 
the  conceptual  missile  analyzed  in  this  report.  A  rejection  rate  of  0.003%  is  then  applicable  to 
an  individual  part  which  is  under  test  for  1  hour,  and  a  rate  of  0.03%  for  a  part  tested  for  6  min¬ 
utes.  Most  vendor  quality  control  programs  are  based  on  an  Acceptable  Quality  Level  (AQL) 
of  1%,  and  are  almost  worthless  insofar  as  assuring  rejection  rates  of  0.003%  per  hour  of  test, 
or  less. 

A  1%  AQL  vendor  control  program  can  be  of  value  when  used  as  a  screening  mechanism, 
provided  it  is  recognized  exactly  as  such.  Contractual  means  can  and  must  be  used  to  stop  the 
purchase  of  parts  from  vendors  whenever  the  AQL  reaches  or  passes  1%  defective.  For  parts 
with  an  AQL  below  1%  and  yet  above  0.1%,  100%  sampling  should  be  accomplished,  preferably 
under  overstressed  conditions.  Parts  with  AQL*s  of  0,1%  and  lower  can  be  accepted,  on  the 
basis  that  subsequent  tests  will  result  in  sufficient  disclosures  of  unacceptable  parts  to  preclude 
serious  compromise  of  the  reliability  goals. 

As  stated  at  the  beginning  of  this  section,  the  module  (or  equivalent)  level  is  the  optimum 
level  at  which  strict  attention  to  operational  and  qualification  details  must  be  provided.  Com¬ 
prehensive  tests  at  this  level  will  provide  early  feedback  on  bad  lots  of  parts,  and  at  the  same 
time  will  accommodate  the  above  1%  AQL  level  for  the  testing  of  parts.  Good  modules  make  good 
systems,  and  the  early  rejection  of  marginal  modules  will  preclude  large  onounts  of  rework  at 
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later  stages.  Thus,  concentration  of  effort  at  the  module  level  will  result  in  savings  in  the  test¬ 
ing  of  individual  parts,  savings  in  troubleshooting  and  rework  time,  and  achievement  of  the  highest 
possible  reliability  within  the  available  budget. 

The  term  “failure  reporting  and  analysis"  includes  the  standard  procedures  for  such  action, 
and  also  a  check  on  the  reliability  demonstrated  during  assembly  and  tests  versus  the  design  goal 
reliability.  Here  again,  the  costs  for  a  normal  program  of  documentation  and  investigation  are 
staggering.  .A  deductive  program  can  accomplish  the  same  results  at  a  fraction  of  the  cost  of  an 
inductive  program,  and  is  explained  below. 

Consider  the  case  of  the  manufacturer  of  1,000  units  of  the  electronics  section  described 
earlier.  The  required  reliability  under  laboratory  conditions  is  0.970.  For  a  production  lot  of 
1.000  units  the  manufacturer  should  expect  30  failures  for  each  hour  of  test.  By  determining  the 
average  test  time  for  a  unit,  the  total  number  of  allowable  failures  for  the  contract  can  easily  be 
determined.  Comparison  of  the  total  failures  during  the  contract  with  the  allo^vable  number  will 
provide  a  ball-park  go/no-go  indication  as  to  wlu'thcr  or  not  the  reliability  requirements  have  been 
met.  The  normal  method  of  logging  operational  hours  will  provide  a  more  accurate  figure,  but  at 
many  times  the  cost  of  the  deductive  method. 

Similarly,  the  servo  section  is  allowed  a  laboratory  failure  rate  of  0.010  per  hour.  For 
1.000  units.  10  failures  are  allowable  for  each  hour  of  test.  If  average  system  and  subsystem 
test  time  is  5  hours,  then  50  failures  are  allowable  under  the  contract.  Should  the  actual  number 
of  failures  be.  for  instance,  100  when  the  contract  is  50*7  complete,  then  a  serious  problem  is 
indicated.  Under  such  circumstances  ordinar}'  methods  of  failure  analysis  are  inadequate, 
and  improved  degrees  of  corrective  action  are  in  order.  It  is  imperative  that  any  and  all  data, 
which  indicate  a  possibility  of  unsatisfactory  reliability,  be  analyzed  and  processed  on  an  ex¬ 
pedited  basis.  Such  action  will  determine  the  success  or  failure  of  an  ex  post  facto  reliability 
program. 

Questions  have  been  asked  concerning  the  reliability  of  MIL-Spec  parts.  In  general,  MIL- 
Spcc  parts  are  not  guaranteed  to  meet  the  above  high  reliability  requirements,  and  the  three  basic 
areas  of  reliability  control  must  also  be  implemented  for  MlL-Spec  parts.  The  required  corrective 
action  for  a  part  would  be  notification  of  the  appropriate  procuring  agency  concerning  excessive 
failure  rates.  Follow-up  corrective  action  for  unsatisfactory  parts  would  consist  of  informal 
notification  of  the  nature  of  unsatisfactory  operation  to  the  parts  manufacturer,  and/or  to  the 
appropriate  procurement  agency.  .MIL-Spec  parts  should  be  subjected  to  the  same  receiving  in¬ 
spections  and  screening  inspections  as  are  ordinary  parts  whenever  there  is  a  question  as  to  the 
degree  of  reliability  of  the  parts.  The  corrective  action  for  the  subassembly  would  be  derating, 
redesign,  change  of  material  or  material  specifications,  eventual  removal  of  an  unsatisfactory 
vendor  from  the  Qualified  Products  List  (QPL),  or  the  incorporation  of  Specification  Control 
Drawings  to  assure  parts  of  better  quality.  The  minimum  derating  for  any  redesigned  stage  or 
assembly  should  be  5057  if  practicable. 


RELIABILITY  PREDICTION 

Reliability  predictions  are  becoming  a  norma!  requirement  for  military  weapon  systems. 
MIL-STD-756A  is  the  current  standard  for  reliability  predictions. 

The  reliability  of  a  subassembly  is  the  product  of  the  reliability  of  the  individual  parts. 
Thus,  for  parts  installed  in  a  series  configuration: 


=  /?!  •  /?2  •  /?3  •  •  /?5  •  .  •  •  •  Rn 


(3) 
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where  ~  the  over-all  reliability  of  a  subassembly  from  the  logistics  through  the  firing  phases 
-  the  over-all  reliability  of  part  n 

Under  today’s  usage,  the  reliability  of  a  part  depends  upon  stress  ratio,  environment,  storage, 
application,  manufacturing  skill,  and  a  host  of  other  functions.  In  accordance  with  MIL-STD- 
756A,  Rf,  can  be  calculated  by: 

K  " •  ^PF  •  ^F  •  ' 

where  r^  -  reliability  during  storage 

Tp^.  -  reliability  during  preflight  test 
rp  -  reliability  during  airborne  flight 
</  -  reliability  during  intercept  mission 

The  value  of  r^t  can  be  calculated  from  the  basic  reliability  formula: 

o  _  / 


Specifically: 


«  =  e- 


JUr  ^ 


where  \g[  =  storage  failure  rate  in  failures  per  1,000  hours 
tat  =  storage  ti.mc  in  thousands  of  hours 

There  is  a  scarcity  of  available  data  on  storage  failure  rates.  When  specific  data  are  unavail¬ 
able,  the  storage  failure  rate  under  controlled  environment  may  be  postulated  by  multiplying  the 
basic  rate  for  50%  stress  conditions  by  0.001.  Thus 

Aj,  =  O.OOIA^ 

where  A/^  =  basic  laboratory  failure  rate  under  conditions  of  50%  stress. 

The  above  calculation  could  be  off  10%  or  more,  but  a  reliability  estimate  that  is  within 
10%  is  of  much  greater  value  than  the  case  where  funding  limitations  or  excessive  research  time 
results  in  an  incomplete  or  untimely  evaluation.  Another  important  cost  savings  can  be  made  by 
use  of  the  approximation  wherein,  for  the  small  value  of  At, 

17) 

For  example,  e  =  0.9950125  0.9950.  Considerable  calculation  expenses  can  be  saved 

by  making  use  of  this  mathematical  approximation  when  feasible.  The  basic  reliability  of  a 
complex  missile  system  can  be  computed  to  acceptable  accuracy  by  adding  up  the  failure  rates 
of  all  parts,  and  multiplying  the  total  by  a  mission  factor.  Thus 

==  Kst  •  RpF  •  Rf  *  Rl 

where  is  the  probability  that  the  entire  missile  will  survive  storage,  preflight  test,  airborne 
flight,  and  intercept  mission,  and  Rgt,  RpF’  Rp’  Rl  missile  equivalents  to  the 

individual  reliabilities  defined  in  Eq.  4.  Note  that  Eq.  8  is  similar  to  Eq.  4. 

A  typical  missile  can  undergo  the  following  sequence  of  events  subsequent  to  acceptance: 

1.  Storage  for  5  years 

2.  2-hour  test  and  preflight  test 

3.  1C  hours  of  captive  flight  prior  to  firing 

4.  60-second  flight  after  firing 

Equations  1  and  8  can  be  combined  into 

K,  -  (9) 
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Using  =  0.001  =  A^.  A^  =  6.5-^  .  and  -  80^  .  adding  exponents  and  replacing 

individual  failure  rates  by  equivalence  in  terms  of 


-A',  (43.80  +  2  +  65  +  80/60)  hours 


R 


m 


-112.  13A' 
^  e  '' 


hours 


using  A'=^Aj4A2+ . 

where  A;,  =  basic  laboratory  failure  rate  per  hour  for  an  individual  part.  A  simplification  of 
Eq.  7  cannot  be  used  here  since  the  exponent  is  greater  than  0.2.  Equation  7  should  not  be  used 
when  anaivsis  or  tabulation  is  performed  by  a  computer. 

The  input  section  was  apportioned  a  failure  rate  of  3.000*7  per  1.000  hours.  This  can  be 
converted  to  terms  of  over-all  probability  of  failure; 

0=1-R  (11) 


substituting,  =  1  - 

I  -e-3.36 

^Sfbj  =  1  ~  0.035  =  0.965 

where  is  the  probability  of  failure  of  the  input  section  during  the  complex  logistics-  through- 

firing  phases.  The  total  of  the  basic  failure  rates  of  all  parts  in  the  input  section,  then,  should 
be  maintained  at  a  fraction  of  the  originally  apportioned  values.  These  basic  rates  should  be 
obtained  from  MiL-217  or  other  acceptable  documents.  The  important  situation  demonstrated  here 
is  that  this  hypothetical  missile  could  meet  the  reliability  requirements  from  firing  to  intercept 
but  could  barely  survive  to  the  time  of  pickle  (firing  operation).  The  percentage  of  failures 
during  environmental  testing  can  be  expected  to  greatly  exceed  the  percentage  of  failures  that 
occur  during  acceptance  testing.  The  percentage  of  failures  during  the  interval  from  production  to 
firing  also  will  exceed  the  percentage  that  occurs  during  firing.  A  well-planned  environmental 
program  will  bring  about  equivalence  of  these  ratios. 

RELIABILITY  DEMONSTRATION 

The  demonstration  of  required  reliability  for  each  and  every  part  is  impractical  in  a  low-cost 
reliability  program.  For  instance,  a  failure  rate  of  0.06^  per  1,000  hours  would  allow  six  failures 
in  10,900  resistors  tested  for  l.(X)0  hours  each.  The  testing  of  only  100  resistors  for  the  same 
period  would  require  an  increase  of  test  time  to  ](X).000  hours.  There  are  certain  fallacies  in 
this  product  relationship,  but  generally  these  may  be  neglected  for  confidence  levels  below  90^. 

A  smaller  sample  or  fewer  test  hours  without  corresponding  increase  in  the  alternate  vai  table 
would  not  provide  data  at  any  worthwhile  level  of  confidence.  In  individual  cases  of  new  design, 
to  correct  a  high  failure  rate,  a  reliability  demonstration  can  be  the  only  solution  that  will  preclude 
high  producer’s  risk.  Under  such  circumstances,  acceleiated  testing  is  reluctantly  acceptable. 
Typical  rules  of  thumb  presently  in  use  are  (1)  the  failure  rate  of  mica  condensers  increases  in 
proportion  to  the  eighth  power  of  applied  voltage;  and  (2)  a  twentyfold  increase  in  the  failure 
rate  of  small  transformers  occurs  at  10  £  vibration  at  60  cps,  compared  to  the  rate  that  exists  at 
1  g.  Such  rules  of  thumb  arc  empirical  and  subject  to  challenge,  yet  they  arc  used  for  reliability 
analysis  by  a  large  capacitor  manufacturer  and  by  a  leading  manufacturer  of  equipment  for  space 
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vehicles.  Kernel  Department.  Linde  Company,  uses  Veibuli  graphs  and  other  considerations  to 
provide  time  accelerations  of  10,000  to  I.  and  even  higher.  Although  the  final  system  test  can¬ 
not  be  considered  to  be  a  demonstration  of  reliability,  failure  rates  in  excess  of  the  basic  lab¬ 
oratory  rale  can  be  considered  as  indicative  of  unsatisfactory  reliability.  When  a  better  equivalence 
cannot  be  obtained,  the  allowable  failure  rate  at  prefinal  level  can  be  five  times  that  of  the  basic 
laboratory  rate:  the  failure  rate  at  complex  module  or  subassembly  level  can  be  25  times  the  basic 
laboratory  rate.  For  this  missile,  the  percentage  of  failures  during  realistic  environmental  test¬ 
ing  should  be  not  more  than  1 12.13  hours  divided  by  the  quotient  of  the  time  duration  of  final  test¬ 
ing  and  the  percentage  of  failures  during  final  system  test. 

A  reliability  dc  lonstrati  <n  of  the  complete  system  is  almost  mandatory  for  a  high-performance 
missile.  The  reliability  requirement  for  a  flight  period  of  the  control  assembly  of  the  typical 
missile  described  in  this  report  is  0.92.”  under  laboratory  conditions.  Unless  a  specific  confi¬ 
dence  level  is  indicated,  parts  failure  rates,  MTBF  predictions,  and  similar  reliability  data  are 
computed  from  general  formulae  at  a  30^  confidence  level. 

llsere  are  several  acceptable  methods  of  conducting  a  reliability  demonstration: 

1.  Operate  x  missiles  until  all  fail 

2.  Operate  x  missiles  until  y  failures  occur 

3.  Operate  x  missiles  for  z  hours 

Method  3  is  the  most  practical.  There  is  always  a  possibility  that  no  failure  will  occur,  and 
so  the  following  formula  mast  be  used  for  computations  to  a  single  confidence  limit: 


ITlnfUp) 

X\{2r  +  2) 

where  T  =  service  life  at  reliability  p 

T  -  total  test  time,  with  replacement  upon  failure 
In  =  Naperian  logarithm  symbol 
X"  =  distribution  factor 
a  --  1  minus  the  confidence  level  (ratio) 
r  =  number  of  failures 


(12) 


System  reliability  tests  also  can  be  accelerated.  Such  an  acceleration  would  include  a  de¬ 
termination  of  critical,  major,  and  minor  defects  and  testing  to  environmental  excursions  for  a 
specified  number  of  hours. 

Given  a  requirement  for  955c  reliability  for  10  hours  at  905c  confidence  level  under  accelerated 
test,  and  substituting  in  £q.  12, 


2  •  r  •  /n  1/0.95 

10  > - 

>^'0.1(0  + 2) 


(0  failures) 


454.72  >  T 


Hounding  off  the  figures  for  required  test  time,  one  missile  must  be  tested  for  450  hours 
without  a  failure,  or  three  missiles  must  be  tested  for  150  hoers  each,  et«;.  The  sample  must,  of 
course,  be  identical  to  all  other  units  if  data  are  to  be  considered  applicable  to  a  particular  model 
of  missile. 

Table  1  provides  data  as  to  demonstrated  life  with  93%  reliability  at  90%  confidence  level 
for  various  numbers  of  test  missiles  tested  for  1.50  hours. 
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TABLE  1.  Systelm  Demonstrated  Life 


1 

So. 

Total  test 

Demonstrated  life,  hours 

nlissilcs 

tested 

hours 

0  failures 

1  failure 

2  failures 

3  failures 

1 

150 

3.30 

1.96 

1.44 

1.14 

o 

300 

6.60 

3.91 

2.87 

2.27 

3 

450 

9.90 

5.86 

4.30 

3.41 

4 

600 

13.20 

7.82 

5.74 

4.54 

5 

750 

16.50 

9.77 

7.17 

5.67 

For  the  infomiation  given  in  Tnble  ]  it  is  assumed  that  all  missiles  are  made  of  identical 
components  and  with  identical  standards  of  workmanship.  Calculations  are  based  upon  repair  of 
failed  items  and  continuation— not  restart— of  test.  For  an  accelerated  testing  factor  of  10: 1, 
two  missiles  tested  for  150  hours  each  with  two  failures  permissible  during  the  test,  have  demon- 
strated  a  service  life  of  28.7  hours. 

A 

In  Table  2  are  two-place  (chi  squared)  values  for90?c  confidence  level.  The  term  “de¬ 
grees  of  freedom”  refers  to  the  quantity  (2.r  +  2).  (The  90fc  confidence  level  for  a  single  require¬ 
ment  is  the  lower  limit  for  an  805c  conHdence  level  which  calls  out  both  upper  and  lower  limits.) 


TABLE  2.  Values  of  for  90%  Conhdence  LEVEL(a«ai)® 


Degrees  of  freedom 

1 

[ 

2 

4.61 

4 

7.78 

6 

10.6 

8 

13.4 

10 

16.0 

12 

18.5 

14 

21.1 

16 

23.5 

18 

26.0 

20 

28.4 

22 

30.8 

24 

33.2 

26 

35.6 

28 

37.9 

30 

40.3 

“These  values  provide  to  only  three  significant  figures.  Other 
tables  may  he  used  to  achieve  higher  accuracy.  These  values  are  delin¬ 
eated  in  Table  2  only  to  allow  the  reader  to  arrive  at  answers  identical  to 
those  in  Table  1. 


SUMMARY 

This  report  extracts  practical  methods  L'om  the  great  quantity  of  reliability  data  and  proce¬ 
dures  which  have  resulted  in  effective  reliability  achievements  at  some  of  the  largest  clec- 
tromechani  cal  manufacturers  in  the  United  Slates.  Use  of  the  procedures  and  concepts  described 
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herein  can  provide  higher  actual  reliability  than  currently  is  being  achieved  by  programs  in  which 
costs  arc  greater  by  an  order  of  magnitude.  This  program  uses  computers  where  they  should  be 
used.  It  is  to  be  noted  that  the  cognizant  reliability  engineer  is  to  use  ingenuity  and  judgment 
to  direct  the  activities  of  the  computer,^  and  is  not  to  become  lost  in  the  maze  of  data  and  in¬ 
dicated  directions  offered  at  the  computer  output. 
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^Under  no  circumstances  is  this  to  be  interpreted  as  a  license  to  experiment  with  data  progranmed 
to  a  computer  to  obtain  a  desired  or  expected  re^t.  Dtiring  the  1952  election  tabulaticps,  a  computer 
was  propammed  with  past  dection  histories  and  it  predirtra  a  landslide  for  President  Dsenhower 
almost  at  die  start  of  the  processing  of  retains.  Hie  computer  **experts**  become  frantic  and  set  in 
''corrections**  to  show  a  doscr  ena  result.  As  recorded  by  history.  President  Ejsenhower  ««on  ly  a  land¬ 
slide  and  a  major  computer  manufacturer  lost  a  chance  to  lead  the  conqiuter  industry  by  a  wide  margin. 
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